Orca Skills plugin
The official Orca Security set: 20 cloud security skills over MCP and a separate plugin that fixes findings with pull requests.
- 59 ★ on the repository
- Last commit
Broad access
Why this level
- The token opens cloud environment data, and the remediation plugin changes code and creates pull requests on your behalf.
Install
- Works in
Manual install
/plugin marketplace add orcasecurity/orca-skillsThen `claude plugin install orca-skills@orcasecurity`; the remediation plugin `security-engineer@orcasecurity` installs separately.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The token opens cloud environment data, and the remediation plugin changes code and creates pull requests on your behalf.
This is third-party code. Review the repository files before installing.
What it does
The repository holds two plugins for Claude Code, Codex and Cursor. `orca-skills` ships 20 skills that answer cloud security questions through the Orca MCP server: what an alert is, what closes when you fix it, who deployed a resource and how, what happened overnight and where a compliance check fails. The `orca-code-scanner` skill scans freshly changed code locally through the Orca CLI and needs no MCP. The second plugin, `security-engineer`, works autonomously: it fixes Orca findings in source code and opens one pull request per fix. It does not use MCP, reads data through the API and expects the token in the `ORCA_API_TOKEN` variable. The plugins install separately, and the first does not pull in the second.
Who it is for. Security teams and platform engineers whose clouds are covered by Orca and who want to triage alerts and fixes from the agent window.
Good fit when
- In the morning you need to understand what happened overnight and what needs attention.
- Before fixing an alert you want to see which other findings close and what might break.
- A compliance check needs a list of failures and the fastest path to improvement.
- Freshly written code is scanned with the Orca CLI before the commit.
Not a fit when
- The organization has no Orca Security account.
- The agent must not receive a token with access to cloud environment data.
- Autonomous fixes with pull requests are unacceptable: install only `orca-skills`.
Example request
Triage this Orca alert: what it means, which findings close after the fix and what might break.Limitations
An Orca account and a connected Orca MCP server are required, through OAuth2 or an API token in a header. The `security-engineer` plugin needs Python 3.10 or newer, an authenticated `gh`, the `ORCA_API_TOKEN` variable and access to OSV.dev and deps.dev, and it is not meant for Codex, where only `orca-skills` works. The `orca-code-scanner` skill needs a separate Orca CLI. Do not keep the token from `.mcp.json` in a repository.
How to disable. Run `claude plugin uninstall orca-skills@orcasecurity` and `claude plugin uninstall security-engineer@orcasecurity`, then remove the `orca-security` entry from `.mcp.json` and revoke the token in the Orca console.
FAQ
How do I install Orca Skills in Claude Code?
Run `/plugin marketplace add orcasecurity/orca-skills`, then `claude plugin install orca-skills@orcasecurity`. After that connect the Orca MCP server in `.mcp.json`.
How do I install for Codex?
The commands are `codex plugin marketplace add orcasecurity/orca-skills` and `codex plugin add orca-skills --marketplace orcasecurity`. Add the server with `codex mcp add orca-security --url https://mcp.orcasecurity.io`.
How do the two plugins differ?
`orca-skills` reads and explains cloud posture, while `security-engineer` changes code in repositories and opens pull requests. They have different prerequisites and authentication.
Which sign-in methods does the MCP support?
OAuth2 at `https://mcp.orcasecurity.io` and an API token through the `Authorization` header at `https://api.orcasecurity.io/mcp`, handy for automations.
Does the code scanner work without MCP?
Yes. `orca-code-scanner` runs the Orca CLI locally and scans changes without the Orca MCP server.
Discussion
No questions or reviews yet.
Related
PluginsAn AppSec plugin for Claude Code: secret, dependency and code scanners plus skills that judge whether each finding is real
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
A plugin with 88 Microsoft security skills: Defender, Sentinel, Entra, Purview and Intune for Copilot, Claude Code and Cursor.
An open set of Claude Code plugins for compliance: findings from cloud and SaaS, gap reports and OSCAL output
A Claude Code plugin that screens prompts, tool calls and documents for injection and leaks, returning BLOCK, CHALLENGE or ALLOW
README in short
The repository acts as a marketplace with two plugins. Skills are organized by the question each answers, from alert triage to account health and access summaries.